Create Interactive Tour

Windows Analysis Report
http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311

Overview

General Information

Sample URL:	http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311
Analysis ID:	591965
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5556 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4720 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

unarchiver.exe (PID: 5276 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip MD5: 1BFD96908AB2C114F24ABAF0CB630007)

7za.exe (PID: 7100 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xrnioxkz.3on" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: codeload.github.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311 HTTP/1.1Host: codeload.github.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311 HTTP/1.1Host: codeload.github.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unarchiver.exe, 00000004.00000002.367090731.0000000000CAB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4_2_02A802A8		4_2_02A802A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4_2_02A80298		4_2_02A80298

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4720 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xrnioxkz.3on" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4720 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xrnioxkz.3on" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6234ED15-15B4.pma

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\815c238c-ed45-4dca-8fec-b034def276ef.tmp

Jump to behavior

Source: classification engine

Classification label: clean3.win@33/137@5/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6972

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 4_2_00F0B042 GetSystemInfo,

4_2_00F0B042

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xrnioxkz.3on" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	3 Masquerading	1 Input Capture	21 Virtualization/Sandbox Evasion	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311	0%	Virustotal		Browse
http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\5556_332944299\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5556_332944299\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5556_332944299\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5556_332944299\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5556_332944299\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5556_332944299\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://dns.google	0%	URL Reputation	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.203.109	true	false	high
codeload.github.com	140.82.121.10	true	false	high
clients.l.google.com	216.58.215.238	true	false	high
googlehosted.l.googleusercontent.com	172.217.168.33	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311	false	high
https://clients2.googleusercontent.com/crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx	false	high
http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	60d801e9-f85d-4ed7-acd4-5b05072fafc0.tmp.1.dr, 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr, 2f9e8bb4-493c-451a-aa1d-be3f5a98f21a.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	false		high
https://github.com/symfony/symfony)	README.md.5.dr	false		high
https://github.com/symfony/symfony/pulls)	README.md.5.dr	false		high
http://www.yaml.org/spec/1.2/spec.html#id2761573	Inline.php.5.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://github.com/symfony/symfony/issues)	README.md.5.dr	false		high
https://play.google.com	2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://symfony.com/doc/current/components/yaml.html)	README.md.5.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://symfony.com	7za.exe, 00000005.00000003.322869832.0000000001030000.00000004.00000800.00020000.00000000.sdmp, composer.json.5.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://symfony.com/doc/current/contributing/index.html)	README.md.5.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	false		high
https://clients2.googleusercontent.com	2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	false		high
https://apis.google.com	2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	false		high
https://symfony.com/contributors	7za.exe, 00000005.00000003.322869832.0000000001030000.00000004.00000800.00020000.00000000.sdmp, composer.json.5.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
http://www.yaml.org/spec/1.2/spec.html#id2793979	Dumper.php.5.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
140.82.121.10	codeload.github.com	United States	36459	GITHUBUS	false
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
172.217.168.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	591965
Start date and time:	2022-03-18 12:34:24 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@33/137@5/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 45 Number of non-executed functions: 1
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.35.237.194, 23.211.6.115, 142.250.203.110, 142.250.203.99, 173.194.160.72, 34.104.35.123
Excluded domains from analysis (whitelisted): www.bing.com, storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, storeedgefd.dsx.mp.microsoft.com.edgekey.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, r3---sn-1gi7znes.gvt1.com, redirector.gvt1.com, edgedl.me.gvt1.com, store-images.s-microsoft.com, sls.update.microsoft.com, update.googleapis.com, r3.sn-1gi7znes.gvt1.com, displaycatalog.mp.microsoft.com, e16646.dscg.akamaiedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, www.gstatic.com, storeedgefd.dsx.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02A809B7h		4_2_02A802A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 02A809B6h		4_2_02A802A8

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: Inline.php.5.dr	String found in binary or memory: http://www.yaml.org/spec/1.2/spec.html#id2761573
Source: Dumper.php.5.dr	String found in binary or memory: http://www.yaml.org/spec/1.2/spec.html#id2793979
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: symfony-yaml-v4.4.37-0-gd7f637c.zip_Zone.Identifier.2.dr	String found in binary or memory: https://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311
Source: 60d801e9-f85d-4ed7-acd4-5b05072fafc0.tmp.1.dr, 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr, 2f9e8bb4-493c-451a-aa1d-be3f5a98f21a.tmp.1.dr	String found in binary or memory: https://dns.google
Source: 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: README.md.5.dr	String found in binary or memory: https://github.com/symfony/symfony)
Source: README.md.5.dr	String found in binary or memory: https://github.com/symfony/symfony/issues)
Source: README.md.5.dr	String found in binary or memory: https://github.com/symfony/symfony/pulls)
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr	String found in binary or memory: https://r3---sn-1gi7znes.gvt1.com
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: 7za.exe, 00000005.00000003.322869832.0000000001030000.00000004.00000800.00020000.00000000.sdmp, composer.json.5.dr	String found in binary or memory: https://symfony.com
Source: 7za.exe, 00000005.00000003.322869832.0000000001030000.00000004.00000800.00020000.00000000.sdmp, composer.json.5.dr	String found in binary or memory: https://symfony.com/contributors
Source: README.md.5.dr	String found in binary or memory: https://symfony.com/doc/current/components/yaml.html)
Source: README.md.5.dr	String found in binary or memory: https://symfony.com/doc/current/contributing/index.html)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_window.js.0.dr, craw_background.js.0.dr, 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 2113ddc8-4522-443b-8f77-81cfa03eb564.tmp.1.dr, 00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	388
Entropy (8bit):	5.2529463157768355
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10U29hJ5g1B0U2ukyrFk7v:MLF20NaL329hJ5g522r0
MD5:	FF3B761A021930205BEC9D7664AE9258
SHA1:	1039D595C6333358D5F7EE5619FE6794E6F5FDB1
SHA-256:	A3517BC4B1E6470905F9A38466318B302186496E8706F1976F1ED76F3E87AF0F
SHA-512:	1E77D09CF965575EF9800B1EE8947A02D98F88DBFA267300330860757A0C7350AF857A2CB7001C49AFF1F5BD1E0AE6E90F643B27054522CADC730DD14BC3DE11
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5857
Entropy (8bit):	5.041775893035979
Encrypted:	false
SSDEEP:	96:jf8ajR0iXGTFeoBLRYLEQQoxaoSUhfUc4F5ex:Nj9FoIwQgo/Rx
MD5:	DC0B5DAF0D9025427654B13434B0B027
SHA1:	4FC2F1F33CEDC75D5EBC27A75ADEDD8121EEBD32
SHA-256:	F338E5ADA85DDF70E2456DB18F9376F2B78C751BC41C38BA0F3C88C2C11EBC3C
SHA-512:	8D45AF30395971A3B432BB6A922B05D6F13066B01CD2044D0561C7C2F99CFA2F68B8301C61399D575029AB8E287911A871535586850ABA2190173D4ADAB4AE35
Malicious:	false
Reputation:	low
Preview:	CHANGELOG.=========..4.4.0.-----.. * Added support for parsing the inline notation spanning multiple lines.. * Added support to dump `null` as `~` by using the `Yaml::DUMP_NULL_AS_TILDE` flag.. * deprecated accepting STDIN implicitly when using the `lint:yaml` command, use `lint:yaml -` (append a dash) instead to make it explicit...4.3.0.-----.. * Using a mapping inside a multi-line string is deprecated and will throw a `ParseException` in 5.0...4.2.0.-----.. * added support for multiple files or directories in `LintCommand`..4.0.0.-----.. * The behavior of the non-specific tag `!` is changed and now forces. non-evaluating your values.. * complex mappings will throw a `ParseException`. * support for the comma as a group separator for floats has been dropped, use. the underscore instead. * support for the `!!php/object` tag has been dropped, use the `!php/object`. tag instead. * duplicate mapping keys throw a `ParseException`. * non-string mapping keys throw a `ParseException`, us

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2022 13:35:38.370013952 CET	49755	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.377305984 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.377347946 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.377422094 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.387499094 CET	80	49755	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.387576103 CET	49755	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.396188021 CET	49757	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.396466017 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.396493912 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.397125006 CET	49755	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.412328959 CET	80	49757	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.412513018 CET	49757	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.414055109 CET	80	49755	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.447563887 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.490365982 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.490406036 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.491095066 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.491105080 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.491170883 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.492094040 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.492153883 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.554097891 CET	49755	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.570394039 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:38.570441961 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:38.570544004 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:38.570808887 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:38.570832968 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:38.631772995 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:38.657357931 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:38.657398939 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:38.658628941 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:38.658744097 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:38.741518021 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.741554976 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.741638899 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.742543936 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.742559910 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.781979084 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.785435915 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.786705017 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.786828041 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.984909058 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.985099077 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.986100912 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:38.986226082 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:38.986572027 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.986709118 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:38.987334013 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:38.987369061 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:38.988177061 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:38.988198996 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:38.988667965 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:38.988694906 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.024264097 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:39.024349928 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:39.024772882 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:39.040163040 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:39.042370081 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:39.042448997 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:39.042512894 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:39.044066906 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.066237926 CET	49756	443	192.168.2.3	216.58.215.238
Mar 18, 2022 13:35:39.066282988 CET	443	49756	216.58.215.238	192.168.2.3
Mar 18, 2022 13:35:39.066756964 CET	49758	443	192.168.2.3	142.250.203.109
Mar 18, 2022 13:35:39.066786051 CET	443	49758	142.250.203.109	192.168.2.3
Mar 18, 2022 13:35:39.087980032 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088054895 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088104963 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088126898 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.088156939 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088215113 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.088222027 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088242054 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088300943 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.088314056 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088367939 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.088422060 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.088430882 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104058981 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104120970 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104175091 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104216099 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104223013 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104249954 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104274988 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104299068 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104314089 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104326010 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104367018 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104404926 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104434967 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104438066 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104454994 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104460001 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104506969 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104518890 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104561090 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104599953 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104607105 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104619026 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104660034 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104667902 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104677916 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104757071 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.104770899 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104785919 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.104845047 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.127870083 CET	49760	443	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:39.127902985 CET	443	49760	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.416805983 CET	80	49757	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:39.416937113 CET	49757	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:49.434314966 CET	80	49757	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:49.434473038 CET	49757	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:50.604693890 CET	49757	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:50.620776892 CET	80	49757	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:51.700351954 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.700397968 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.700503111 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.700819969 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.700831890 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.759733915 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.782108068 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.782140970 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.782944918 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.783035994 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.784521103 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.784610033 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.786060095 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.786227942 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.786242008 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.786263943 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.806694031 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.806732893 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.806874990 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.806891918 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.806948900 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.807396889 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.808016062 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.808038950 CET	443	49784	172.217.168.33	192.168.2.3
Mar 18, 2022 13:35:51.808052063 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:51.808099985 CET	49784	443	192.168.2.3	172.217.168.33
Mar 18, 2022 13:35:53.413533926 CET	80	49755	140.82.121.10	192.168.2.3
Mar 18, 2022 13:35:53.413671970 CET	49755	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:53.584553957 CET	49755	80	192.168.2.3	140.82.121.10
Mar 18, 2022 13:35:53.600652933 CET	80	49755	140.82.121.10	192.168.2.3

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 18, 2022 13:35:38.258268118 CET	192.168.2.3	8.8.8.8	0xfb54	Standard query (0)	codeload.github.com	A (IP address)	IN (0x0001)
Mar 18, 2022 13:35:38.279771090 CET	192.168.2.3	8.8.8.8	0xd7be	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Mar 18, 2022 13:35:38.346879005 CET	192.168.2.3	8.8.8.8	0x948d	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Mar 18, 2022 13:35:51.671808004 CET	192.168.2.3	8.8.8.8	0xda3a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Mar 18, 2022 13:37:51.697551966 CET	192.168.2.3	8.8.8.8	0xbd8c	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Mar 18, 2022 13:35:38.280996084 CET	8.8.8.8	192.168.2.3	0xfb54	No error (0)	codeload.github.com		140.82.121.10	A (IP address)	IN (0x0001)
Mar 18, 2022 13:35:38.308912992 CET	8.8.8.8	192.168.2.3	0xd7be	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Mar 18, 2022 13:35:38.308912992 CET	8.8.8.8	192.168.2.3	0xd7be	No error (0)	clients.l.google.com		216.58.215.238	A (IP address)	IN (0x0001)
Mar 18, 2022 13:35:38.373532057 CET	8.8.8.8	192.168.2.3	0x948d	No error (0)	accounts.google.com		142.250.203.109	A (IP address)	IN (0x0001)
Mar 18, 2022 13:35:51.698872089 CET	8.8.8.8	192.168.2.3	0xda3a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Mar 18, 2022 13:35:51.698872089 CET	8.8.8.8	192.168.2.3	0xda3a	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)
Mar 18, 2022 13:37:51.725701094 CET	8.8.8.8	192.168.2.3	0xbd8c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Mar 18, 2022 13:37:51.725701094 CET	8.8.8.8	192.168.2.3	0xbd8c	No error (0)	googlehosted.l.googleusercontent.com		172.217.168.33	A (IP address)	IN (0x0001)

Timestamp	kBytes transferred	Direction	Data
Mar 18, 2022 13:35:38.397125006 CET	1217	OUT	GET /symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311 HTTP/1.1 Host: codeload.github.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Mar 18, 2022 13:35:38.414055109 CET	1218	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311

Timestamp	kBytes transferred	Direction	Data
2022-03-18 12:35:38 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-18 12:35:39 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-9FLiuK4QSSKOA2VCnPf8FA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 18 Mar 2022 12:35:39 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5555 X-Daystart: 20139 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-03-18 12:35:39 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 35 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 30 31 33 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5555" elapsed_seconds="20139"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-03-18 12:35:39 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-03-18 12:35:39 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-03-18 12:35:38 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-18 12:35:38 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-03-18 12:35:39 UTC	4	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 18 Mar 2022 12:35:39 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-xZ0b9Bx2Ipm2D7HfZuqOZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-xZ0b9Bx2Ipm2D7HfZuqOZg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-03-18 12:35:39 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-03-18 12:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-03-18 12:35:51 UTC	37	OUT	GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-18 12:35:51 UTC	38	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycduqpEWtVtc4ZUKm4KD9jQwwJjDiezw9fUy8dWHJIaF31lKP4AHBbkKSpqxfOwg5n0sGXciIiXY_xvf2iEgPiwk Content-Disposition: attachment; filename="extension_8520_615_0_5.crx" Cross-Origin-Resource-Policy: same-site Accept-Ranges: bytes X-Goog-Hash: crc32c=DxAZGA== Content-Length: 768843 Server: UploadServer Date: Thu, 17 Mar 2022 21:05:54 GMT Expires: Fri, 17 Mar 2023 21:05:54 GMT Cache-Control: public, max-age=31536000 Age: 55797 Last-Modified: Wed, 05 Aug 2020 01:15:29 GMT ETag: 730d2491_a246e948_e80d9c94_d8b3f142_86eb8dd2 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-03-18 12:35:51 UTC	38	IN	Data Raw: 43 72 32 34 03 00 00 00 18 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2022-03-18 12:35:51 UTC	39	IN	Data Raw: ca cb a3 80 eb 8b 1c a8 07 a9 3d 61 65 c8 c2 d3 30 c2 ff f6 cc 90 8b f9 14 44 55 b1 1f a8 1a 6e 1c 91 f5 6e 12 3b ff 49 70 72 cc a2 1f 51 db 15 1c 81 3a 10 b6 e5 20 3c e2 ad 87 0f d5 1e 80 61 09 59 dc 93 f3 83 96 97 87 7b 65 69 9e cd 12 a8 02 0a a2 01 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 cd 4d 62 68 3d 9f 5b 4f 7d b2 2b 1b ae 55 af 4b 48 46 28 6e 33 e8 5c 22 d7 dd d8 2c 67 d7 63 0e b5 8a 36 29 13 10 28 dd 45 ed ff 00 55 db fa ff 23 92 69 ad 61 03 e7 3a 04 98 9f 4e 89 fd 0a 1d 0e 50 88 1b a9 78 ef 4f a0 90 ea 28 6d 43 3b 7c eb 35 01 53 ac 7b 6d ea 61 45 78 8d bb 91 5b 7f 98 66 50 af 69 60 85 79 cc c2 35 b1 88 52 02 84 8b 90 76 7f 24 1a cf 2e b4 00 bd 6c 2d 6d ee b5 02 03 01 00 01 12 80 01 9a a3 91 dc 6d 10 Data Ascii: =ae0DUnn;IprQ: <aY{ei00*H0Mbh=[O}+UKHF(n3\",gc6)(EU#ia:NPxO(mC;\|5S{maEx[fPi`y5Rv$.l-mm
2022-03-18 12:35:51 UTC	40	IN	Data Raw: 77 0d f5 97 97 c5 5f 2f ee 4b 21 c4 5f 5e de 7e 29 ae 9a 3f 8a c1 c7 9b f2 f2 e7 8b 83 8f 77 77 5f 6e 7f 7a f9 f2 f6 fe cb 97 eb 9b bb 17 1f 6a 3b be 58 5f ff fa 72 bd d5 ec cb e2 ea f6 df e5 cd 4b 08 bb 2a 89 5f 1c 0c ee 8a 9b 0f e5 1d 8c 5f ae 3e 17 57 ff bc 38 68 04 57 0f 19 ac 3f 17 b7 b7 70 f1 a6 fc d7 fd a7 9b 72 f3 3c ce 08 06 5e 7d 78 7e fb f1 fa df 70 f1 7f ee ae bf bc b8 bd bf bc fc b4 fe 04 8b 3b 2e cb cd aa 58 57 a2 6a 15 40 46 b0 99 55 06 9e 99 69 25 32 27 d9 60 40 0f c3 54 2a 57 e8 61 24 24 d0 59 30 1d a0 d3 c5 2c ef b6 1e 00 31 f7 64 d3 b3 96 91 0f 99 4e 45 d3 31 4b 63 4d 47 0d f6 3b ea d5 06 08 c9 60 85 f7 ca 04 25 25 9f d1 eb e0 30 31 ee e2 c8 60 5c 26 20 9b 40 82 ca bc 08 da b0 e5 57 6c c7 37 d9 13 d3 66 94 a2 02 c8 10 01 4a 8a 75 0a 02 Data Ascii: w_/K!_^~)?ww_nzj;X_rK__>W8hW?pr<^}x~p;.XWj@FUi%2'`@TWa$$Y0,1dNE1KcMG;`%%01`\& @Wl7fJu
2022-03-18 12:35:51 UTC	41	IN	Data Raw: 50 76 a3 9d 09 c2 58 61 80 31 5b de 09 1f d7 40 b6 42 55 3d 6c 6f 80 83 85 4c 08 e3 be 83 df 3c 6c 95 58 00 2b 52 42 5c b4 a3 e9 e8 90 f5 00 4c fc b4 1c 95 ad 07 ab 8d 6f 6f 8d 54 81 3a aa a3 88 45 b7 9f db fc b8 cd 34 1c a4 2f c8 d3 56 ad 05 64 e8 c5 c2 1d 97 6b ff e8 92 ca 4d fa c0 82 a0 9b cd 2a c5 b6 b8 32 0a bc d8 f0 a7 fd f9 1d 53 75 85 47 b6 62 5b 97 15 31 5f ec 34 e8 4b 82 df 3b dd f5 26 a3 7f 47 af 7c 4f 33 bc 69 98 32 ae b8 bf d7 fd c4 f6 f6 dd cd f5 fd ea 73 79 fb f1 fa fa 0e db dc 56 69 d7 74 4c 2d f0 51 c0 2e ca 67 19 00 85 20 ac 64 d1 02 96 dd 08 6b 75 1c 99 59 5b 6d c2 d8 10 64 d5 21 60 db 48 3b c1 17 9b 72 85 d9 7a 55 d3 94 b3 da 5b 88 6f ed 83 75 3a 28 eb d8 8e 03 44 7d 1d 23 9d 94 a5 77 f7 49 08 6d 8c f6 c4 ac 17 7b 72 0d 3c 7d f7 e9 f9 Data Ascii: PvXa1[@BU=loL<lX+RB\LooT:E4/VdkM*2SuGb[1_4K;&G\|O3i2syVitL-Q.g dkuY[md!`H;rzU[ou:(D}#wIm{r<}
2022-03-18 12:35:51 UTC	43	IN	Data Raw: 99 c5 91 4d 0d 49 77 54 3b 27 68 d1 9c 97 d4 bf 7b 33 52 9b 72 ba 09 24 e6 1f 9c a8 95 56 1a 6f 24 00 7c 40 f9 19 f8 30 37 d3 e6 d4 62 1c 03 d3 94 36 68 11 94 87 e9 3b b5 67 77 22 7d 31 81 0d 1f 30 71 80 3c ec a4 b4 42 54 d1 c3 35 69 38 22 ec 33 e1 aa 6d 2e 51 6d bb 18 e0 59 66 cf 0b 0c 0f 70 d9 d8 d4 a2 fb 54 a1 a3 e3 76 9c 26 87 3b e2 9e 47 db bf 69 0a 4c a8 7a 35 e0 b4 32 78 98 5f f0 c0 fe bf 7b 6e 0d 7a 41 c1 15 1a 87 ac ed aa c2 65 ab 73 76 7b 28 59 ef 09 08 94 0f 15 ea ed f9 b8 9e b5 26 fe 56 14 e4 a7 82 b2 0f 86 9d 94 7e 3c 9c a1 0a eb 03 a7 f1 38 22 a2 f5 35 e6 21 34 3d a9 cb cd 69 05 ec 3e 56 a7 a1 33 e1 bd f6 0a a2 05 c2 86 ed a8 fd 8e 3b 8d 4f df ce 8d 00 86 c8 e0 4e 48 3d 79 a7 f6 2c 3f 1a 0d 97 d3 c9 62 9e 4f 97 c3 a3 a3 d1 7c 34 19 0f 4f 97 Data Ascii: MIwT;'h{3Rr$Vo$\|@07b6h;gw"}10q<BT5i8"3m.QmYfpTv&;GiLz52x_{nzAesv{(Y&V~<8"5!4=i>V3;ONH=y,?bO\|4O

Target ID:	0
Start time:	13:35:32
Start date:	18/03/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	1
Start time:	13:35:34
Start date:	18/03/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	2
Start time:	13:35:40
Start date:	18/03/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1596,8936167362834516135,6393328557860566166,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=4720 /prefetch:8
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	4
Start time:	13:35:41
Start date:	18/03/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip
Imagebase:	0x620000
File size:	10752 bytes
MD5 hash:	1BFD96908AB2C114F24ABAF0CB630007
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Target ID:	5
Start time:	13:35:44
Start date:	18/03/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\xrnioxkz.3on" "C:\Users\user\Downloads\symfony-yaml-v4.4.37-0-gd7f637c.zip
Imagebase:	0x1120000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	6
Start time:	13:35:45
Start date:	18/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Execution Coverage:	18.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5%
Total number of Nodes:	80
Total number of Limit Nodes:	5

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\0ad303a2-3121-4ed0-8342-bf35eac1d0e2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2cf16204-d9ea-4bc6-98d2-ee1b7e8eae01.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4f73c07a-1d78-4c55-bac3-e96f074f1842.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\57c4947e-36cb-4df3-a865-fbf1c29f6be0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\597005f4-801f-4afc-aeac-86214fe336cf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6f386ddd-ace5-405f-88ae-172bf831f646.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000001.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000002.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\00926c4a-a589-47bc-954f-f1f88f1f35b0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2113ddc8-4522-443b-8f77-81cfa03eb564.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\228f7d20-75b8-448c-95ed-cfcb18fec1fb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\33dba751-a1ac-41f2-91b8-ed66de6e4783.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3edbade9-0206-497c-bcbf-e0f92fd42b53.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\58d9d836-1531-4ec4-be62-366caba696bc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6deb36bc-f774-449c-8510-e840bd89aad6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7d235fc6-61b8-4018-9331-746ad76fb00e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\91a796f3-1a25-4514-b817-d9988d6801ae.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

Windows Analysis Report
http://codeload.github.com/symfony/yaml/legacy.zip/d7f637cc0f0cc14beb0984f2bb50da560b271311

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre